5889 An object was deleted from the COM+ Catalog
Written when an object is deleted from the COM+ Catalog. Paired with addition 5890, it tracks changes to the COM+ configuration.
Overview
The subcategory is Audit Other Object Access Events. It is generated when an object registered in the COM+ Catalog is deleted.
How it is triggered
- Unregistering or deleting a COM+ application/component.
Security review points
- Deleting a legitimate COM+ component can affect dependent applications. Also consider an attacker later deleting a COM+ object they used to erase traces. Cross-reference with the addition 5890 and modification 5888 history.
Notes for log review
- It also occurs during app uninstalls. Match the deletion target and subject against normal patterns.
- Read it as part of a sequence of COM+ configuration changes (add to modify to delete).
Key fields
| Field | Meaning |
|---|---|
| Target object | The deleted COM+ object |
Subject\Account Name | The subject that performed the deletion |